fix-abandoned-dependency-readiness — WorksGood live mirror

Metadata

Status	done
Assigned	`agent-931`
Model	`pi:openai-codex:gpt-5.6-sol`
Created	2026-07-28T14:06:57.315922489+00:00
Started	2026-07-28T15:48:34.168245930+00:00
Completed	2026-07-28T16:26:33.320628711+00:00
Tokens	22052124 in / 33382 out

Description

User-reported safety bug

A historical production chain showed an abandoned prerequisite making an obsolete downstream packaging/launch task runnable. This remains current, explicit policy: Status::is_dep_satisfied() returns true for Done | Abandoned, ready_tasks tests pin that behavior, archived boundaries are accepted regardless of recorded status, and coordinator recovery has another missing/terminal shortcut.

Clean-room reproduction with the installed current binary:

before abandon: ready=[prerequisite]
after abandon:  ready=[downstream]
why-blocked: downstream is_ready=true, total_blockers=0

This is unsafe. after is a required-success edge. Abandonment means the prerequisite will not produce its promised artifact; it is terminal for liveness/retention only, never success evidence.

Normative semantics

Keep Abandoned terminal for lifecycle, cleanup, cycle membership, UI history, and no-retry semantics.
Separate terminality from dependency satisfaction. For ordinary required after edges, only exact successful completion (Done plus any applicable acceptance receipt/gate) satisfies. Abandoned, Failed, unresolved/missing, waiting, stale, and incomplete states block.
An ordinary dependent whose prerequisite is abandoned must never become dispatcher-ready, claimable, spawnable, auto-unblocked, completable by a worker, mergeable, or eligible for downstream finalization.
Canonical dependency_disposition is the single authority. Remove divergent shortcuts in ready/status/why-blocked/coordinator stuck-unblock/manual-done/federation/archive paths.
An ArchivedBoundary already records status: only a boundary whose recorded status is Done can satisfy. Archived Abandoned remains a visible failed-closed blocker. A truly missing dependency blocks; deletion/GC must not manufacture success.
Remote dependencies obey the same status semantics.
Preserve evaluation-system relation-aware exceptions only where necessary for an owning satellite to resolve a source soft state. Never generalize dot-prefix or terminal status into success.
Existing graphs upgrade fail closed without rewriting history. Open/Blocked dependents immediately remain non-ready. For any already-live attempt launched under the obsolete rule, stop acceptance/merge, preserve/fence the exact process safely, retain its work as evidence, and require operator review; never blindly kill a writer or retroactively mark success.
Already-Done historical descendants remain immutable history but are flagged by an audit/check diagnostic as completed-through-abandoned-prerequisite; do not reopen them automatically.

Explicit operator escape paths

wg abandon must report affected active ordinary dependents and state that they remain blocked.
--superseded-by remains provenance, not success. Diagnostics name replacements but do not silently treat them as done or rewrite ambiguous AND/OR dependency intent.
To proceed intentionally, the operator must perform an explicit graph mutation: retry/reopen the prerequisite, relink the dependent to a completed replacement, or remove/waive the edge with audited rationale. Existing wg rm-dep may serve if it records adequate provenance; otherwise add a narrowly-scoped audited dependency waiver. No reason string or ordinary message counts as a waiver.
wg why-blocked, wg show, stable JSON, TUI detail and Activity must say blocked: prerequisite X was abandoned and show supersession/repair commands. Do not misleadingly report zero blockers because abandoned is terminal.

Validation

Preserve a RED installed-binary/old-source regression proving before=[prerequisite], abandon, after=[downstream] today.
Unit/integration tests reverse the old assertions: local and remote Abandoned never satisfy ordinary dependencies; Done still does; Failed/missing remain blocked.
Credential-free installed-binary daemon smoke builds prerequisite -> packaging -> launch, abandons each upstream shape, and proves no dependent claim/spawn/PID/worktree/session/evaluation/merge or readiness event appears across repeated polls and restart.
Same smoke proves explicit audited edge removal/relink permits progress, while --superseded-by alone does not.
Archived Done boundary satisfies; archived Abandoned boundary blocks before/after daemon restart and archive undo.
Coordinator stale-block reconciliation delegates to canonical disposition and cannot treat missing/abandoned as success.
Worker wg_done cannot bypass an abandoned dependency; explicit operator waiver is content/edge-bound, attributable, idempotent and visible.
Upgrade audit catches already-running and already-Done descendants without destructive reset or historical mutation.
Cycles, evaluation satellites, archive/GC, federation, status/why-blocked, lifecycle and service readiness suites remain sound.
cargo fmt --check, cargo clippy, focused/full tests and owned smoke pass; commit/push and wg done finalize normally.

## User-reported safety bug
A historical production chain showed an abandoned prerequisite making an obsolete downstream packaging/launch task runnable. This remains current, explicit policy: `Status::is_dep_satisfied()` returns true for `Done | Abandoned`, `ready_tasks` tests pin that behavior, archived boundaries are accepted regardless of recorded status, and coordinator recovery has another missing/terminal shortcut.

Clean-room reproduction with the installed current binary:

```text
before abandon: ready=[prerequisite]
after abandon: ready=[downstream]
why-blocked: downstream is_ready=true, total_blockers=0
```

This is unsafe. `after` is a required-success edge. Abandonment means the prerequisite will not produce its promised artifact; it is terminal for liveness/retention only, never success evidence.

## Normative semantics
- Keep `Abandoned` terminal for lifecycle, cleanup, cycle membership, UI history, and no-retry semantics.
- Separate terminality from dependency satisfaction. For ordinary required `after` edges, only exact successful completion (`Done` plus any applicable acceptance receipt/gate) satisfies. `Abandoned`, `Failed`, unresolved/missing, waiting, stale, and incomplete states block.
- An ordinary dependent whose prerequisite is abandoned must never become dispatcher-ready, claimable, spawnable, auto-unblocked, completable by a worker, mergeable, or eligible for downstream finalization.
- Canonical `dependency_disposition` is the single authority. Remove divergent shortcuts in ready/status/why-blocked/coordinator stuck-unblock/manual-done/federation/archive paths.
- An `ArchivedBoundary` already records status: only a boundary whose recorded status is `Done` can satisfy. Archived `Abandoned` remains a visible failed-closed blocker. A truly missing dependency blocks; deletion/GC must not manufacture success.
- Remote dependencies obey the same status semantics.
- Preserve evaluation-system relation-aware exceptions only where necessary for an owning satellite to resolve a source soft state. Never generalize dot-prefix or terminal status into success.
- Existing graphs upgrade fail closed without rewriting history. Open/Blocked dependents immediately remain non-ready. For any already-live attempt launched under the obsolete rule, stop acceptance/merge, preserve/fence the exact process safely, retain its work as evidence, and require operator review; never blindly kill a writer or retroactively mark success.
- Already-Done historical descendants remain immutable history but are flagged by an audit/check diagnostic as `completed-through-abandoned-prerequisite`; do not reopen them automatically.

## Explicit operator escape paths
- `wg abandon` must report affected active ordinary dependents and state that they remain blocked.
- `--superseded-by` remains provenance, not success. Diagnostics name replacements but do not silently treat them as done or rewrite ambiguous AND/OR dependency intent.
- To proceed intentionally, the operator must perform an explicit graph mutation: retry/reopen the prerequisite, relink the dependent to a completed replacement, or remove/waive the edge with audited rationale. Existing `wg rm-dep` may serve if it records adequate provenance; otherwise add a narrowly-scoped audited dependency waiver. No reason string or ordinary message counts as a waiver.
- `wg why-blocked`, `wg show`, stable JSON, TUI detail and Activity must say `blocked: prerequisite X was abandoned` and show supersession/repair commands. Do not misleadingly report zero blockers because abandoned is terminal.

## Validation
- [ ] Preserve a RED installed-binary/old-source regression proving `before=[prerequisite]`, abandon, `after=[downstream]` today.
- [ ] Unit/integration tests reverse the old assertions: local and remote Abandoned never satisfy ordinary dependencies; Done still does; Failed/missing remain blocked.
- [ ] Credential-free installed-binary daemon smoke builds prerequisite -> packaging -> launch, abandons each upstream shape, and proves no dependent claim/spawn/PID/worktree/session/evaluation/merge or readiness event appears across repeated polls and restart.
- [ ] Same smoke proves explicit audited edge removal/relink permits progress, while `--superseded-by` alone does not.
- [ ] Archived Done boundary satisfies; archived Abandoned boundary blocks before/after daemon restart and archive undo.
- [ ] Coordinator stale-block reconciliation delegates to canonical disposition and cannot treat missing/abandoned as success.
- [ ] Worker `wg_done` cannot bypass an abandoned dependency; explicit operator waiver is content/edge-bound, attributable, idempotent and visible.
- [ ] Upgrade audit catches already-running and already-Done descendants without destructive reset or historical mutation.
- [ ] Cycles, evaluation satellites, archive/GC, federation, status/why-blocked, lifecycle and service readiness suites remain sound.
- [ ] `cargo fmt --check`, `cargo clippy`, focused/full tests and owned smoke pass; commit/push and `wg done` finalize normally.

Depends on

done flip-first-required-gate

Required by

done fix-attempt-runtime-state-namespace

Log

2026-07-28T14:06:57.286084105+00:00 Task paused
2026-07-28T14:06:57.382405084+00:00 Task published
2026-07-28T15:46:53.887415726+00:00 Spawn preparation deferred before launch permit; rollback is complete and no circuit-breaker charge was recorded. Repair the reported checkout/configuration condition and retry: spawn transaction for agent-931 rolled back (task remains dispatchable; rollback diagnostics: complete): failed to establish isolated-worktree observer baseline: observer source tuple mismatch
2026-07-28T15:48:34.384753508+00:00 Spawned by coordinator --executor pi --model openai-codex:gpt-5.6-sol --isolation required-worktree
2026-07-28T15:48:52.523780674+00:00 Starting implementation: mapping canonical dependency disposition, abandoned/archive/remote readiness shortcuts, worker completion gates, diagnostics, and regression coverage.
2026-07-28T16:12:24.066879759+00:00 Core implementation complete: exact-Done dependency semantics now flow through canonical disposition for local/remote/archive/readiness/coordinator, claim/spawn launch gate/done/merge are fenced, diagnostics/audit/TUI/Activity added, and installed-binary daemon/archive/waiver smoke passes.
2026-07-28T16:20:38.679604719+00:00 Validated: cargo fmt --check and plain cargo clippy pass; focused query/check/done/why-blocked/abandon/coordinator/candidate-finalization suites pass; owned installed-binary daemon/archive/waiver smoke passes. Full cargo test reached library completion with only 9 pre-existing profile::named env-lock failures, then timed out in later targets; no remaining task-specific failure.
2026-07-28T16:21:01.340592566+00:00 Committed: 7ec7b231 — pushed to remote
2026-07-28T16:24:58.195462897+00:00 Validated global installed binary: owned smoke passes after cargo install; candidate finalization 6/6, coordinator 79/79, why-blocked 12/12, abandon 9/9, focused query/check/done suites pass. Full library run exposed only the known 9 profile::named env-lock failures from dependency baseline; task-specific failure was corrected and revalidated.
2026-07-28T16:26:33.320629011+00:00 Task marked as done